UPI Study › Courses › Ethics in Technology › Free lessons › Lesson 1.4 Free with a free account
Why Failing to Protect Information Can Cost Organizations Money, Trust, and Reputation
Ethics in Technology · Chapter 1: What Cybersecurity Means and Why Protecting Digital Information Is Everyone's ResponsibilitySection 1.4 · lesson 4 of 11614 min · free with a free account
Free preview
Create a free account to keep watching
It takes a minute and costs nothing. Your free account unlocks all of Chapter 1 and 3 more lessons of Ethics in Technology.
Lesson complete
Earn the 3 college credits for Ethics in Technology
Enrolling adds a quiz after each lesson, the graded work and the official transcript. Recommended for credit by NCCRS.
Next lesson: Confidentiality, Integrity, and Availability — The Three Pillars Every Security Professional Lives By →← How the Field of Protecting Digital Information Has Evolved Over the DecadesNext lesson: Confidentiality, Integrity, and Availability — The Three Pillars Every Security Professional Lives By →
In this lesson
The repair bill is only part of the loss.
- Calculate response, recovery, and downtime costs
- Distinguish penalties from wider losses
- Connect trust and reputation with future revenue
- Interpret breach averages and cost drivers
Free study notes
Get this lesson's notes by email
The key points and 4 practice questions with answers, in your inbox. One email, free.
One email. Unsubscribe in one click.
Transcript
Everything said in the video, section by section (1,768 words). Read along, or search it.
Chapter 1
The Business Cost of Security Failure
Security failure affects the business, rather than stopping at the computers involved in an incident. An organization pays to investigate and repair, while losing work and sales during disruption. Regulatory consequences, customer departures, and damaged reputation can extend the loss much further. The source compares this with a leaking roof: the repair bill does not include everything water damaged. We begin with response, recovery, and downtime, the direct costs easiest to count. A hypothetical retailer then shows how the stated assumptions combine into a substantial bill. Historical incidents and enforcement cases illustrate different routes through which costs develop. We connect trust with revenue, and reputation with investors' expectations of future earnings. Finally, industry research helps compare patterns, provided we keep dates, samples, and averages in view. The purpose is to understand exposure, rather than mistake a headline number for an individual forecast.
Direct Costs
Response, Recovery, and Downtime
Incident response covers identifying what happened, stopping the harm, and investigating the route into systems. Outside forensic specialists and crisis-communication advisers may add to that immediate bill. Recovery restores information and operation, through backups, rebuilding, replacement, and repairs to the exploited weakness. Staff overtime can be necessary, especially when normal work must continue alongside restoration. Downtime adds losses while the systems or services remain unavailable. Those losses include missed sales, employees unable to work, and orders or deadlines that cannot be met. For an online business, unavailable systems can stop the very activity through which revenue is earned. Factories, hospitals, and transport services also depend on systems supporting continuous operation. The leaking-roof analogy reminds us that repairing the original fault leaves other losses to consider. Direct costs are the visible starting point, rather than the complete measure of business harm.
Retailer Example
36 Hours Without Working Systems
The source's worked example uses a hypothetical midsized online retailer affected by ransomware. Its usual sales are fifty thousand dollars per hour, before the systems become unavailable. The disruption lasts thirty-six hours, giving a defined period over which lost sales are calculated. Two hundred employees cannot perform their jobs during that same period. Their average hourly wage is forty dollars, providing another stated input for the exercise. These assumptions describe this example, rather than every business affected by an outage. The calculation also includes response specialists, additional technology-team hours, and restoration expenses. Keeping each item visible makes the source of the total easier to understand. It also prevents a vague repair estimate from hiding the ongoing losses during downtime. We can now add the listed amounts, while remembering which later consequences are not included.
Adding the Bill
Total Direct Cost: USD 2,388,000
Fifty thousand dollars per hour, across thirty-six hours, gives one million eight hundred thousand dollars in lost sales. Two hundred employees, at forty dollars per hour for thirty-six hours, produce two hundred eighty-eight thousand dollars in idle wages. Investigation and containment by the response firm cost one hundred fifty thousand dollars in this example. Additional technology-staff hours add sixty thousand dollars, while rebuilding and restoring systems add ninety thousand dollars. Adding all five items gives two million three hundred eighty-eight thousand dollars in direct costs. Lost sales alone account for approximately three quarters of that stated total. The result explains why downtime can dominate a bill, even when restoration work is expensive. Every additional hour unavailable extends the losses associated with the business's dependence on its systems. The total still excludes penalties, customers who do not return, and longer-lasting reputational consequences. Use it as the source's defined exercise, with its assumptions visible and its limits understood.
Historical Cases
Operational Harm Reaches Beyond IT
In twenty seventeen, NotPetya spread through the network of the global shipping business, A P Moller Maersk. Thousands of servers, and tens of thousands of computers, had to be rebuilt. The company estimated losses of roughly two hundred fifty to three hundred million dollars. That example combines extensive restoration with the consequences of disrupted operational activity. In twenty twenty-one, a ransomware incident affected Colonial Pipeline's business systems. The pipeline was shut down for several days, with fuel shortages along the East Coast. The source reports a ransom payment of about four point four million dollars. These historical examples illustrate scale, without making the same amount a forecast for another organization. They also show why the affected technical system is only part of the incident's reach. Follow the dependency outward, from systems to operations, customers, and services people need.
Different Frameworks
Legal and Industry Consequences Differ
Formal requirements create another cost pathway, through legal or industry consequences for inadequate protection. The European Union's General Data Protection Regulation provides substantial maximum penalties for relevant infringements. The upper ceiling can be twenty million euros, or four percent of worldwide annual turnover, whichever is higher. That maximum does not mean every violation receives the same fine. The United States HIPAA framework uses tiered civil penalties, with caps for calendar-year violations. Specific amounts and application depend on the framework, rather than a single universal health-record penalty. Payment Card Industry Data Security Standard requirements are industry rules, rather than a statute. Card-program consequences can include financial charges, processing changes, or loss of the ability to accept cards. India's Digital Personal Data Protection Act, twenty twenty-three, provides a security-safeguard penalty ceiling of two hundred fifty crore rupees. That is about two point five billion rupees; distinguish a statutory provision from an automatic fine or enforcement timetable.
Historical Enforcement
Separate Fines From Settlements
Historical enforcement illustrates the need to keep the amount, year, and type of consequence together. In twenty twenty, the United Kingdom's Information Commissioner's Office fined British Airways twenty million pounds. The case involved weak security and the theft of customer details during twenty eighteen. The same authority fined Marriott eighteen point four million pounds, for exposed reservation information. In twenty twenty, the United States Office of the Comptroller of the Currency penalized Capital One eighty million dollars. The source connects its cloud-risk failures with the twenty nineteen exposure affecting about one hundred million people. Equifax's twenty nineteen settlement could reach seven hundred million dollars, rather than being one standalone fine. The settlement involved federal and state authorities, following a breach affecting approximately one hundred forty-seven million people. The source links that twenty seventeen incident with failure to patch a known weakness. Keep settlement and fine distinct, while recognizing that either adds to the wider business losses.
Trust and Revenue
Customers Can Leave Long After Recovery
Customers provide information on the assumption that the organization will handle it responsibly. A breach can break that confidence, leading people to close accounts, shop elsewhere, or buy less. Replacing departing customers costs money, while their negative accounts can discourage new customers. Organizations may also fund monitoring, discounts, or campaigns intended to rebuild confidence. Passing costs to customers through higher prices can risk further departures. In late twenty thirteen, Target suffered a breach during the holiday shopping period. The source describes about forty million affected payment-card accounts, and personal information on about seventy million people. The reported quarterly profit fell nearly by half, compared with the previous year. That comparison does not prove the breach alone caused every part of the earnings change. The chief executive left months later, illustrating how an incident can remain an organizational concern after technical recovery.
Reputation and Investors
Expected Future Earnings Shape Share Value
Reputation extends beyond customers, to partners, job seekers, the media, and regulators. Partners may hesitate to share information, while prospective employees may question the organization's reliability. For a listed company, investors value shares through expectations about future earnings. A breach can increase expected costs, customer losses, and uncertainty about further problems. Selling pressure can then reduce the share price, although actual results vary widely. The source's share-price chart is illustrative, and should not be read as real market data. Its historical Equifax example describes shares losing roughly a third of their value within weeks of announcement. That announcement came in September twenty seventeen, alongside a period of senior leadership departures. A lower share value can affect financing, and the value of shares held by employees. Prompt action, honest communication, and evidence of a fix help an organization rebuild confidence over time.
Industry Research
Read the Date and the Sample
IBM publishes the Cost of a Data Breach Report, researched by the Ponemon Institute. The source describes the twenty twenty-six edition as studying six hundred two organizations in sixteen countries. Their breaches occurred between March twenty twenty-five, and February twenty twenty-six. The reported global average reached four point nine nine million dollars, twelve percent higher than the previous year. That figure is an average across the studied breaches, rather than the price of every incident. The source chart places the United States average at eleven point five million dollars in twenty twenty-six. Its healthcare comparison is seven point four two million dollars, explicitly from twenty twenty-five. Keep that different year visible, rather than implying all three figures come from the same period. Location, legal exposure, sensitive records, and operational dependence help explain why averages differ. A comparison becomes useful only when the reader knows what each number actually describes.
Cost Drivers
Reduce Time and Improve Preparedness
Time affects costs, because longer exposure can allow more information to be reached and more systems damaged. The twenty twenty-six data cited in the source reports two hundred forty-seven days to identify and contain a breach. That lifecycle covers discovery and containment, rather than only the time spent rebuilding afterward. Extensive security artificial intelligence and automation are associated with lower average costs in the cited research. The reported difference is about one point nine three million dollars, compared with organizations using none. An observed average difference does not guarantee the same saving from an individual purchase. Sensitive health, financial, and personal information can increase consequences, through harm and tighter obligations. Location also changes exposure, because rules, legal expenses, and operating conditions differ across regions. Preparation matters too: a tested response plan helps people make faster decisions under pressure. These factors explain variation, and identify practical questions to ask before treating the average as a prediction.
Averages Need Context
A Trend Is Not an Individual Forecast
The source's historical series begins at three point nine two million dollars in twenty nineteen. Twenty twenty falls to three point eight six million, before twenty twenty-one reaches four point two four million. Twenty twenty-two reaches four point three five million, and twenty twenty-three reaches four point four five million. Twenty twenty-four reaches four point eight eight million, followed by four point four four million in twenty twenty-five. The twenty twenty-six figure then rises to four point nine nine million dollars. That changing series describes study averages, including a dip before the newer high. These surveys mainly describe larger organizations, so the amounts should not be transferred mechanically to small firms. A small business can face a smaller absolute bill, yet lose a much larger share of its income. Some cannot recover from a serious interruption, making resilience a business question as well as a technical one. Count the visible costs, then consider trust, reputation, and remaining exposure beyond the repair bill.
About Ethics in Technology at UPI Study
Ethics in Technology (Computer Science 195) is a self-paced online course of 116 video lessons in 15 chapters, from cybersecurity basics, privacy and surveillance to big data, hacking, malware, network defense, intellectual property, cybercrime, encryption, emerging technology and digital citizenship. It carries a NCCRS credit recommendation for 3 semester credits.
Every lesson transcript is free on pages like this one, and the videos are free with a free UPI Study account. Enrolling adds a practice quiz after each lesson, the graded work and final exam that earn the credit, lifetime access, and an official transcript on completion. UPI Study has helped over 130,000 students with college credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Enroll now → Course details Download the syllabus All Computer Science courses
Compare: Cybersecurity vs Ethics in Technology · Which ethics course?
Why take it here
Why students take Ethics in Technology with UPI Study
Where the credit goes
Universities that work with NCCRS
Ethics in Technology carries a NCCRS credit recommendation. These universities work with NCCRS; some are UPI Study's signed partners. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Thomas Edison State UniversitySigned partner
University of the PeopleSigned partner
Charter Oak State CollegeSigned partner
Strayer UniversitySigned partner
Columbia Southern UniversitySigned partner
Indiana TechSigned partner
Penn StateWorks with NCCRS
Southern New Hampshire UniversityWorks with NCCRS
SUNYWorks with NCCRS
+many more cooperating universitiesFind my college →Find my college → Not listed? Ask Athena in the corner of this page, or book a 15-minute call.
FAQ
Questions students ask us
About Why Failing to Protect Information Can Cost Organizations Money, Trust, and Reputation
What costs does a data breach cause for a business?
How do you calculate the cost of downtime from a cyberattack?
What is the average cost of a data breach?
What fines have companies paid for poor data security?
About the Ethics in Technology course
How many college credits is Ethics in Technology?
How much does Ethics in Technology cost and what is included?
Which universities accept UPI Study credits?
How long does Ethics in Technology take?
How are the exams done?
How do my credits reach my college?
Ready for the full course? Earn 3 credits in Ethics in Technology.
116 video lessons, a quiz after each one, and the graded work that earns the credit. Recommended for credit by NCCRS.
3 credits · NCCRSEnroll →